| Package | Affected versions | Patched versions |
|---|---|---|
| pfsense | ≥ 2.3.0, ≤ 2.9.0 |
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free